BaselineWatch
276 checks
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

Windows test plan

What to test on a Windows release so the baseline still holds: the checks of Microsoft Windows 11 V2R11, by area
Derive from
The release under test
Areas to test Untick an area to leave it out of the exports; it stays on the page, marked as not tested this time.
Export the kept checks Untick a check, then Rebuild or export; the form carries the state and nothing is stored. One area is drawn at a time; what you untick in one is kept when you open another, and every export covers the whole plan: the checks kept, what was left out and why, a findings table and a sign-off.
The report looks
Plain
Calibri and grey tables, nothing else: the look before styles.
Formal assessment
A government assessment report in the SP 800-53A manner: serif headings, numbered sections, cover page. Cover page. Numbered sections.
Engineering runbook
For the engineer at the keyboard: monospaced headings, dark command blocks. Numbered sections.
Executive
Navy and teal with a cover page: for the people who sign it off. Cover page.
Compact checklist
Black on white, small type, no cover: prints the most checks per page.
Modern
A clean product look in indigo and slate.
Dark console
Light text on a dark page, terminal colours: for screens, not paper.
Board
Issue-tracker blues and lane greys, as the decisions board draws them.
Audit workpaper
Ledger green and auditor blue, with room for initials and references. Cover page. Numbered sections.
Markdown-native
How the report reads on GitHub: system fonts, ruled headings, grey code.
Word
Office's own blues: the house style of a document written in Word. Cover page. Numbered sections.

The look applies to Word, PDF, LaTeX and the printable checklist; Markdown, CSV and JSON stay plain. Each follows one of the mockups in docs/mockups/exports.

Link to this plan: the release, hardware and areas as a URL to bookmark or send; unticked checks do not travel with it.

Hardware root of trust and secure enclave 14 kept

  1. Procedure

    Verify the system has a TPM and is ready for use. Run "tpm.msc". Review the sections in the center pane. "Status" must indicate it has been configured with a message such as "The TPM is ready for use" or "The TPM is on and ownership has been taken". TPM Manufacturer Information - Specific Version = 2.0 If a TPM is not found or is not ready for use, this is a finding.

  2. Procedure

    Verify the system firmware is configured to run in UEFI mode, not Legacy BIOS. Run "System Information". Under "System Summary", if "BIOS Mode" does not display "UEFI", this is a finding.

  3. Procedure

    Verify the system firmware is configured for Secure Boot. Run "System Information". Under "System Summary", if "Secure Boot State" does not display "On", this is a finding.

  4. Procedure

    Confirm VBS is enabled and running with Secure Boot or Secure Boot and DMA Protection. If there are documented operational mission needs to disable VBS, this may be reduced to a CAT III finding. Run "PowerShell" with elevated privileges (run as administrator). Enter the following: "Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard" If "RequiredSecurityProperties" does not include a value of "2" indicating "Secure Boot" (e.g., "{1, 2}"), this is a finding. If "Secure Boot and DMA Protection" is configured, "3" will also be displayed in the results (e.g., "{1, 2, 3}"). If "VirtualizationBasedSecurityStatus" is not a value of "2" indicating "Running", this is a finding. Alternately: Run "System Information". Under "System Summary", verify the following: If "Device Guard virtualization-based security" does not display "Running", this is a finding. If "Device Guard Required Security Properties" does not display "Base Virtualization Support, Secure Boot", this is a finding. If "Secure Boot and DMA Protection" is configured, "DMA Protection" will also be displayed (e.g., "Base Virtualization Support, Secure Boot, DMA Protection"). The policy settings referenced in the Fix section will configure the following registry values. However, due to hardware requirements, the registry values alone do not ensure proper function. Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\ Value Name: EnableVirtualizationBasedSecurity Value Type: REG_DWORD Value: 1 Value Name: RequirePlatformSecurityFeatures Value Type: REG_DWORD Value: 1 (Secure Boot only) or 3 (Secure Boot and DMA Protection) A Microsoft article on the Credential Guard system requirement can be found at the following link: https://technet.microsoft.com/en-us/itpro/windows/keep-secure/credential-guard-requirements

  5. Procedure

    Confirm Credential Guard is running. Run "PowerShell" with elevated privileges (run as administrator). Enter the following: "Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard" If "SecurityServicesRunning" does not include a value of "1" (e.g., "{1, 2}"), this is a finding. Alternately: Run "System Information". Under "System Summary", verify the following: If "virtualization-based Services Running" does not list "Credential Guard", this is a finding. The policy settings referenced in the Fix section will configure the following registry value. However, due to hardware requirements, the registry value alone does not ensure proper function. Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\ Value Name: LsaCfgFlags Value Type: REG_DWORD Value: 0x00000001 (1) (Enabled with UEFI lock)

  6. Procedure

    Confirm virtualization-based protection of code integrity. If there are documented operational mission needs to disable code integrity, this may be reduced to a CAT II finding. Run "PowerShell" with elevated privileges (run as administrator). Enter the following: "Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard" If "SecurityServicesRunning" does not include a value of "2" (e.g., "{1, 2}"), this is a finding. Alternately: Run "System Information". Under "System Summary", verify the following: If "Virtualization-based Security Services Running" does not list "Hypervisor enforced Code Integrity", this is a finding. The policy settings referenced in the Fix section will configure the following registry value. However, due to hardware requirements, the registry value alone does not ensure proper function. Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\ Value Name: HypervisorEnforcedCodeIntegrity Value Type: REG_DWORD Value: 0x00000001 (1) (Enabled with UEFI lock), or 0x00000002 (2) (Enabled without lock)

  7. Procedure

    Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If any groups or accounts other than the following are granted the "Modify firmware environment values" user right, this is a finding: Administrators

  8. Microsoft Learn, "Get-Tpm" (TPM, Secure Boot, virtualization-based security and BitLocker on a Windows PC)
    Success looks like: TpmPresent, TpmReady, TpmEnabled and TpmActivated are True and LockedOut is False; note ManufacturerIdTxt and ManufacturerVersion for the firmware inventory.
    If it does not: TpmPresent False on a Windows 11 PC means the TPM is disabled in firmware; enable it and clear it only if the device is not yet in use. LockedOut True means repeated bad authorisations; wait out the lockout or reset it from firmware, then find the cause.
  9. Microsoft Learn, "Confirm-SecureBootUEFI" (TPM, Secure Boot, virtualization-based security and BitLocker on a Windows PC)
    Success looks like: True.
    If it does not: False means Secure Boot is turned off in firmware; "Cmdlet not supported on this platform" means the PC booted in legacy BIOS mode and needs a UEFI reinstall before anything else in this plan is worth testing.
  10. Microsoft Learn, "Enable virtualization-based protection of code integrity" (TPM, Secure Boot, virtualization-based security and BitLocker on a Windows PC)
    Success looks like: VirtualizationBasedSecurityStatus is 2 (running); SecurityServicesRunning contains 1 (Credential Guard) and 2 (memory integrity, HVCI), and 3 (System Guard Secure Launch) where the hardware supports it; AvailableSecurityProperties lists 2 (Secure Boot) and 3 (DMA protection).
    If it does not: Status 1 means configured but not running: a restart or a firmware setting (virtualisation, IOMMU) is missing. A missing 1 on an Enterprise or Education device means Credential Guard was turned off or the device lacks the prerequisites; the System log, source WinInit, event 13 confirms it started and 15 to 17 say why it did not.
  11. Microsoft Learn, "System Guard Secure Launch and SMM protection" (TPM, Secure Boot, virtualization-based security and BitLocker on a Windows PC)
    Success looks like: Kernel DMA Protection On, Secure Boot State On, and the running services match the previous step.
    If it does not: Kernel DMA Protection Off on hardware that supports it is a firmware setting; on hardware that does not, record the exception and rely on the BitLocker pre-boot PIN.
  12. Microsoft Learn, "Microsoft Pluton as a trusted platform module" (TPM, Secure Boot, virtualization-based security and BitLocker on a Windows PC)
    Success looks like: The TPM manufacturer is Microsoft (Pluton) and the firmware version matches the latest Windows Update.
    If it does not: A discrete or firmware TPM from another vendor means Pluton is present but not in use, which is how 2026 and later AMD and Qualcomm designs ship; test that TPM's firmware against the vendor's advisories instead.
  13. Microsoft Learn, "BitLocker operations guide" (TPM, Secure Boot, virtualization-based security and BitLocker on a Windows PC)
    Success looks like: VolumeStatus FullyEncrypted, ProtectionStatus On, EncryptionMethod XtsAes256, key protectors TPM (or TPM and PIN where the baseline requires it) and RecoveryPassword, with the recovery password escrowed to Entra ID or Active Directory.
    If it does not: "Waiting for Activation" means only the clear protector exists: add the TPM and recovery-password protectors and back the password up with BackupToAAD-BitLockerKeyProtector. ProtectionStatus Off means protection was suspended: Resume-BitLocker, then find who suspended it.
  14. Microsoft Learn, "Windows compliance settings in Microsoft Intune" (TPM, Secure Boot, virtualization-based security and BitLocker on a Windows PC)
    Success looks like: The device-health rules (BitLocker, Secure Boot, code integrity) and the system-security rules (TPM, encryption, firewall, antivirus) all read compliant; the minimum OS version rule matches the build the fleet runs.
    If it does not: A device-health rule still failing after BitLocker was turned on needs a restart before attestation re-measures; a TPM rule failing with Get-Tpm healthy points at a stale compliance evaluation, so sync the device and wait for the next report.